CalleesMatchingParam

The CalleesMatchingParam object defines the parameters used to enumerate and annotate specified function callees. It is used with the ProjectHandle:callees_matching method to filter and analyze call sites based on function names, predicates, and dataflow annotations.

Fields

Field	Description	Type
`from`	Function(s) whose callees are enumerated	`string`, `AddressValue`, or `CallsFromQuery`
`where`	Predicate function to filter function callees	`fun(callee: FunctionContext)`
`using`	Lua expression specifying parameter annotations for the dataflow engine	Lua expression
`debug`	Enables debug logs for the matching process	`boolean`

Reference

from

The function(s) whose callees are enumerated. It can be a string (function name), an AddressValue (function address), or a CallsFromQuery with pattern matching options.

where

A Lua function used to filter callees. Receives a FunctionContext object and should return true for callees to include.

using

A Lua expression specifying how to annotate parameters and callees for dataflow analysis.

parameters assigns annotations to the parameters of the function being analyzed. For example: parameters = {var:named "src", var:named "dst"}
callees assigns annotations to parameters and return values of functions called within the analyzed function. For example callees = { FunctionName = {output = ..., inputs = {...}} }

Do not use the same annotation name multiple times.

debug

If set to true, enables debug logging for the matching process.

Example

The following example finds all callees of process_request named target that also call malloc. It annotates parameters and callees for dataflow tracking.

local results = project:callees_matching({
  from = "process_request",
  where = function(callee)
    return callee:named "target" and callee:has_call "malloc"
  end,
  using = {
    parameters = {var:named "name", var:named "value"},
    callees = {
      ["malloc"] = {output = var:named "env", inputs = {_}},
      ["strlen"] = {output = var:named "len", inputs = {_}}
    }
  }
})

Conventions

VulHunt Rules

Scopes

Types

Standard Library

Fields

Reference

from

where

using

debug

Example

​Fields

​Reference

​from

​where

​using

​debug

​Example

Fields

Reference

from

where

using

debug

Example